FIRST TIER, DOWNSTREAM AND RELATED ENTITY (FDR) COMPLIANCE GUIDE

FIRST TIER, DOWNSTREAM AND RELATED ENTITY (FDR) COMPLIANCE GUIDE I. Introduction Viva Health s Commitment to Compliance Viva Health, Inc. ( Viva ) requires and promotes integrity, and an ethical, efficient and compliant approach to the delivery of health care services and administrative/management services. We are committed to conducting our business with the highest ethical standards and in compliance with all applicable federal and state laws and regulations. Requirements for a Compliance Program Viva is contracted with the Centers for Medicare & Medicaid Services ( CMS ) as a Medicare Advantage Organization ( MAO ) that provides coverage to Medicare beneficiaries for Medicare Parts A and B services as well as Part D prescription drug coverage. Our contract with CMS requires that we maintain an effective Compliance Program as stated in the following CMS guidance: Title 42 of the Code of Federal Regulations ( CFR ), Parts 422 and 423 (referred to as Parts C & D ) Medicare Managed Care Manual, Chapter 21 Compliance Program Guidelines and the Prescription Drug Benefit Manual, Chapter 9 Compliance Program Guidelines (both manuals contain identical guidance) located at: https://www.cms.gov/medicare/prescription-drug-coverage/prescriptiondrugcovcontra/ Downloads/Chapter9.pdf Vendors Providing Cost-Effective Solutions Viva has contracts with individuals and entities ( vendors ) that possess expertise, skill and knowledge of their respective industries, trades or professions and that have the ability to provide efficient and cost-effective health care and/or administrative services. When a vendor provides a core health care and/or administrative service that is required of Viva under our contract with CMS, the vendor meets the definition of First Tier, Downstream and Related Entity ( FDR ). II. What is a FDR CMS defines a FDR as follows: A. First Tier Entity - is any party that enters into a written arrangement, acceptable to CMS, with a MAO to provide administrative services or health care services to a Medicare-eligible individual under the Medicare Advantage Program Part C and/or Part D program (e.g., vendors contracted with Viva to provide claim processing, utilization management, transportation, or other core healthcare and/or administrative functions). B. Downstream Entity - is a party that enters into a written arrangement, acceptable to CMS, with persons or entities involved with the Medicare Advantage benefit or Part D benefit, below the level of the arrangement between a MAO and a First Tier Entity (e.g., vendors contracted with a FDR to help fulfill its contractual obligations to Viva). The written arrangements continue down to the level of the ultimate provider of services for both health and administrative functions. C. Related Entity - means any entity that is related to a MAO by common ownership or control and: 1. Performs some MAO management functions under contract or delegation; 2. Furnishes services to Medicare enrollees under an oral or written agreement; or 3. Leases real property or sells materials to the MAO at a cost of more than $2,500 during a contract period. 1

III. What is the Purpose of this FDR Compliance Guide? This FDR Compliance Guide is being provided to you because you have been identified as a FDR for Viva. CMS requires FDRs to fulfill the same Compliance Program requirements that apply to Viva. The Guide also contains additional expectations Viva requires of all FDRs. You ll find a summary of requirements in this guide Please use this document as a quick reference guide to understanding the CMS Compliance Program requirements and to ensure that you have internal processes to support your Compliance Program. Note: Section I of this Guide provides information for where you can obtain more detailed guidance on the CMS Compliance Program requirements. IV. FDR Compliance Program Requirements Viva is committed to ensuring our FDRs are in compliance with applicable laws, rules and regulations. It is important that you follow these requirements FDRs are expected to adhere to CMS Compliance Program requirements and Viva s standards when conducting business on Viva s behalf. Compliance Program Elements Your organization and your Downstream Entities (if any) must comply with CMS Compliance Program requirements. There are seven (7) elements required to ensure that your Compliance Program meets CMS standards: Element 1: Written Policies, Procedures and Standards of Conduct Element 2: Designating a Compliance Officer and Oversight of Compliance Program Element 3: Effective Training and Education Element 4: Effective Lines of Communication Element 5: Well-Publicized Disciplinary Standards Element 6: Effective System for Routine Monitoring and Identification of Compliance Risks Element 7: Prompt Response to Compliance Issues ELEMENT 1: WRITTEN POLICIES, PROCEDURES AND STANDARDS OF CONDUCT FDRs must provide written policies and procedures or Standards of Conduct to all employees providing administrative and/or health care services for Viva. FDRs must also ensure their Downstream Entities distribute appropriate policies and procedures or Standards of Conduct to their employees that address similar requirements. These policies and procedures or Standards of Conduct should include the following information: FDRs commitment to comply with all applicable Federal and State standards; FDRs expectations of its employees compliance with the policies or Standards; The FDRs Compliance Program operation; 2

Appropriate guidance to employees and others on dealing with suspected, detected or reported compliance issues; Details on how employees should communicate compliance issues to appropriate compliance personnel; Description of how suspected, detected or reported compliance issues are investigated/resolved; and Non-intimidation and non-retaliation protections for individuals that make good faith reports of noncompliance related to its Compliance Program. Such information must be distributed to FDR employees and contractors: Within 90 days of hire/contract; and Annually thereafter. FDRs can determine the most effective method of distributing the policies and procedures or Standards of Conduct (e.g., via hardcopy at the time of hire/contract, via electronic copy, posting a copy on the FDR s intranet, etc.). A FDR must maintain documentation that demonstrates the information was distributed. ELEMENT 2: DESIGNATING A COMPLIANCE OFFICER AND OVERSIGHT OF COMPLIANCE PROGRAM Each FDR must designate a senior level employee to act as the Compliance Officer for its organization. The Compliance Officer must maintain responsibility for the implementation of the FDR s Compliance Program, including responding to reports of potential fraud, waste and abuse (FWA) and non-compliance. The Compliance Officer also ensures documentation is maintained related to the Compliance Program and is responsible for overseeing, developing, and monitoring corrective action plans. The Compliance Officer must have direct access to the FDR s senior-most leader (typically the CEO or President/Owner) and/or the FDRs governing body (if applicable). ELEMENT 3: EFFECTIVE TRAINING AND EDUCATION FDRs must ensure that their employees and Downstream Entities, assigned to provide administrative and/ or health care services for Viva, complete training related to the functions performed for Viva. In addition, training must be provided on the topics listed in this section. Compliance and Fraud Waste and Abuse (FWA) training FDRs are responsible for general compliance and fraud, waste and abuse (FWA) training. Training must be provided: Within 90 days of hire/contract date; and At least annually thereafter. Who should complete training? Not every employee in the organization needs to complete compliance and FWA training. Below are examples of critical roles within a FDR that clearly should be required to fulfill the training requirements: Senior administrators or managers directly responsible for the FDR s contract with Viva (e.g., senior vice president, departmental managers, etc.) Individuals directly involved with establishing and administering the FDRs contract with Viva 3

(e.g., individuals involved with clinical decisions or coverage decisions, processing appeals and grievances or enrollments/disenrollments, processing of pharmacy or medical claims, etc.) Individuals involved with decision-making authority that relate to the FDRs contract with Viva Individuals with job functions that place the FDR in a position to perform functions or make decisions that could result in the FDR not complying with CMS Compliance Program requirements or committing FWA If you have questions about which employee positions within your organization should be required to take the training, please contact Viva s Delegated Vendor Oversight Program Manager, Tanya Maddox at tanyamaddox@uabmc.edu. Compliance and FWA Training Content CMS requires FDRs to use the Medicare Learning Network (MLN) general compliance training (called Medicare Parts C and D General Compliance Training ), and the MLN FWA training (called Combating Medicare Parts C and D Fraud Waste and Abuse Training ). FDRs can require employees to complete the training by visiting MLN s website at https://www.cms.gov/ Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/Fraud-Waste_Abuse- Training_12_13_11.pdf, or by incorporating these training modules into the FDR s training materials/system. The content of the CMS training modules cannot be changed (except as noted in the modules) to ensure the integrity and completeness of the training. Privacy and Security Training FDRs are required to protect all of Vivas member information. This not only includes Protected Health Information (PHI), but also includes Personally Identifiable Information (PII). Employees that have access to PHI and/or PII must receive HIPAA Privacy and Security training at the time of hire (not to exceed 90 days from date of hire) and annually thereafter. Privacy and Security training should address topics such as: Federal and state laws governing the confidentiality of PHI and PII When PHI and PII may be accessed, used and disclosed Safeguards for protecting the integrity, confidentiality, and availability of PHI and PII Validation of Training Completion FDRs must retain records of training completion on the topics listed previously. Evidence may include signin sheets/training logs (if classroom training is provided), electronic certificates/reports generated from the FDR s training system, etc. Note: The printable certificates provided at the end of the MLN training modules are sufficient evidence of Compliance/FWA training. Viva will confirm these training requirements have been met as part of our annual attestation process and during FDR audits, if applicable. To validate training completion, please ensure the following information is retained for a minimum of 10 years per CMS requirements: Employee names Dates of employment Dates of completion Results of test scores (if captured) Title of training Training content 4

ELEMENT 4: EFFECTIVE LINES OF COMMUNICATION A FDR must maintain effective communication between its employees and its downstream entities. This should include broadcasting the name, contact and location information for its Compliance Officer and communicate the information to any downstream entities. FDRs must adopt a policy of non-intimidation and non-retaliation of employees, including whistleblowers, for good faith reporting of concerns regarding non-compliance or FWA. FDRs must advertise to its employees, the policy of non-intimidation and non-retaliation. How to report suspected compliance issues FDR employees are expected to report any suspected issues of non-compliance or FWA to the FDR s designated Compliance Officer as well as using alternative reporting mechanisms (including anonymous reporting). This may include, but is not limited to, reporting via the FDR s website, compliance hotline, etc. Viva provides additional reporting mechanisms for a FDR s employees How to Report Ethics, Compliance & FWA Concerns. Please feel free to publicize this flyer to your employees. ELEMENT 5: WELL-PUBLICIZED DISCIPLINARY STANDARDS FDRs must require their employees to adhere to the requirements of its Compliance Program. FDRs should provide examples for their employees of what constitutes non-compliant, unethical and/or illegal behavior that are in violation of the Compliance Program as well as publicizing disciplinary standards that will be enforced when non-compliance is identified. Some examples of the types of publication methods include: FDR s Intranet site; General compliance training; and Posters prominently displayed throughout employee work and break areas. Enforcement of Disciplinary Standards FDRs must be able to demonstrate that disciplinary standards are enforced timely, consistently, and in an effective manner. Records pertaining to any disciplinary action in response to a compliance violation should be maintained for a period of 10 years. ***FDRs must report any issue of non-compliance or FWA to Viva if the issue is in any way associated with the services performed on Viva s behalf.*** ELEMENT 6: EFFECTIVE SYSTEM FOR ROUTINE MONITORING AND IDENTIFICATION OF COMPLIANCE RISKS Viva is ultimately responsible for fulfilling the terms and conditions of our contract with CMS. If any function is performed by a FDR, CMS requires monitoring and/or auditing of these functions to ensure such functions are performed in accordance with applicable laws and regulations. FDRs must perform exclusion screenings Federal law prohibits Medicare, Medicaid and other federal health care programs from paying for items or services provided by an individual or entity excluded from participation in these federal programs. 5

FDRs must screen employees (permanent and temporary), volunteers, consultants, governing body members, contractors and downstream entities against the following exclusion/debarment sources prior to employing or contracting with the employee/contractor and monthly thereafter: Office of Inspector General (OIG): https://exclusions.oig.hhs.gov/ System for Award Management (SAM): https://www.sam.gov/portal/sam FDRs must maintain evidence they checked these exclusion sources for a minimum of 10 years. Viva requires, at a minimum, an annual attestation that all employees were appropriately screened. You re not alone! We re also required to check these exclusion sources prior to hiring or contracting with individuals/entities and monthly thereafter. You must take action if an individual/contractor is on the exclusion list If any individual or entity performing services for Viva is on the OIG or SAM exclusion list, you must immediately remove them from working directly or indirectly with Viva s business and notify us as soon as possible. Avoiding a Conflict of Interest A conflict of interest (COI) exists when the interests of a FDR or its employees influence or appear to influence their ability to make objective decisions in the course of the FDR job duties and/or responsibilities. A COI may also exist if the demands of any outside activities hinder or distract an employee from the performance of job duties or responsibilities, or result in use of company resources for other than company purposes. FDRs and its employees must avoid a COI at all times. If a potential COI arises, the activity must be reported to the the FDR s Compliance Officer. If a COI relates directly to Viva s business, this must be reported to Viva immediately. ELEMENT 7: PROMPT RESPONSE TO COMPLIANCE ISSUES Reporting compliance concerns and/or FWA to Viva There are a number of ways to report suspected or detected non-compliance or potential FWA to Viva. Don t worry your reports are confidential. You can find the reporting mechanisms in the Viva How to Report Ethics, Compliance and FWA Concerns flyer located on our website at http://vivahealth.com/fdr/default. aspx#compliance. You can share the flyer with your employees or Downstream Entities. You can also keep it as a reference tool and use your own internal processes for reporting and collecting these issues. If you choose to use your own processes, make sure that any issues of non-compliance and/or FWA are reported in a timely manner to Viva. FDRs must adopt and enforce a zero-tolerance policy for retaliation or intimidation against anyone, including whistleblowers, who report suspected misconduct in good faith. Any issues of detected non-compliance or potential FWA must be investigated in a timely manner and reported to the appropriate parties. Corrective Action Plans You must notify Viva immediately if non-compliance is identified related to the functions you provide for Viva. Viva may require you to conduct a root cause analysis and implement a Corrective Action Plan (CAP). The CAP must contain the following: Date non-compliance identified 6

Root cause Period of non-compliance How the non-compliance was identified Issue of non-compliance Corrective action (including dates and key milestones) Viva provides a CAP template and instructions to assist FDRs in documenting non-compliance and corrective actions. You can find the instructions and template at http://vivahealth.com/fdr/default.aspx#compliance. Viva expects FDRs to take action on all issues of non-compliance and FWA timely. This includes timely implementation of disciplinary actions, when applicable, to prevent recurrence of non-compliance. V. Routine Monitoring and Auditing Viva routinely monitors and periodically audits all First Tier Entities. This helps us ensure compliant administration of our contracts with CMS and helps us ensure compliance with applicable laws and regulations. FDRs must cooperate and participate in monitoring and auditing activities. First Tier Entities are also responsible for self-monitoring/auditing the functions they provide for Viva. If a First Tier Entity contracts with other individuals/entities to provide administrative and/or health care services to help fulfill its obligations to Viva, the First Tier Entity must monitor/audit the Downstream Entity to ensure it performs such functions in accordance with all applicable laws and regulations and in accordance with the First Tier Entities contract with Viva. The First Tier Entity must also ensure its contracts with Downstream Entities contain CMS-required provisions. If FDR functions are not in compliance with applicable laws and regulations, or in compliance with the terms of its contract with Viva, we will require the FDR to develop and submit a CAP (as referenced above). VI. Offshore Operations and CMS Reporting All work performed by FDRs on Viva s behalf must be performed within the United States and its territories (including America Samoa, Guam, Northern Marianas, Puerto Rico, and Virgin Islands). A FDR may request approval in advance from Viva to utilize employees or contractors located outside the United States. We refer to work being performed outside the United States and its territories as being offshore. If Viva approves a requested offshore arrangement, Viva must self-disclose the offshore arrangement to CMS. FDRs must also sign an attestation annually as to how it will oversee the offshore functions. VII. Additional Standards for Conducting Services In addition to meeting the CMS Compliance Program requirements, Viva also expects FDRs to: Maintain current federal, state and local licenses and permits required for the operation of the FDR s business or profession. Ensure that services provided for Viva are performed in a competent, timely, efficient, professional, and skillful 7

manner as well as in compliance with applicable laws, regulations and the terms of its agreement with Viva. Render services at the lowest reasonable cost and make the most efficient use of resources required to provide such services. Ensure services provided for Viva are done so in a highly ethical manner and by individuals or entities that meet trustworthiness and behavioral standards. Ensure services provided for Viva are conducted in an alcohol and drug-free workplace. FDR shall prohibit the unlawful manufacture, distribution, dispensation, possession or use of alcohol, illegal drugs, and/or drug paraphernalia at the workplace or while conducting any aspect of services for Viva. Prohibit unacceptable and unethical behaviors by individuals and entities providing services for Viva. VIII. FDR Attestation Requirements FDRs must maintain evidence of compliance with the requirements listed in this Guide for no less than 10 years. Each year, an authorized representative from your organization must attest to your compliance with these requirements. A FDR s authorized representative is an individual who is ultimately responsible for assuring your organization provides services for Viva in a complaint manner. An authorized representative could include your Compliance Officer, a Chief Executive Officer, Chief Operations Officer or someone in a similar position. IX. What if a FDR Fails to Comply? If a FDR fails to meet any of these Compliance Program requirements, this puts Viva and our members at risk and may lead to: Development of a corrective action plan (CAP) Additional monitoring/auditing Monetary penalties Termination of your contract with Viva Viva s response to issues of non-compliance will depend on the severity of the compliance issue. If a FDR, Viva, CMS or any regulatory oversight agency identifies areas of non-compliance performed by a FDR, it must take prompt action to correct the issue and prevent it from happening again. X. Questions or Comments? If you have any questions regarding this Guide or the CMS Compliance Program requirements, please contact Tanya Maddox, Delegated Vendor Oversight Program Manager as follows: Email: tanyamaddox@uabmc.edu Phone: 205-558-3283 Address: 417 20th Street North, Ste. 1100, Birmingham, AL 35203 8